Vulnerabilities

TI-2026-81983 CVE-2026-59177

ESPHome Device Builder ingress site skips authentication on LAN

MEDIUM 42

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01168 Published 2026-10-28 Fixed in 1.0.10 CWE-1327

TI-2026-42331 CVE-2026-59178 · GHSA-rrxg-g2pf-6hh4

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

MEDIUM 50

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00779 Published 2026-09-14 Fixed in 1.0.12 CWE-306

TI-2026-49928 CVE-2026-71260 · GHSA-qmjj-2rwx-5ffc

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

LOW 29

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00275 Published 2026-08-05 No fix listed CWE-522

TI-2026-49927 CVE-2026-71259 · GHSA-2g7j-rv69-9w67

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

LOW 38

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00174 Published 2026-08-05 No fix listed CWE-184

TI-2026-19197 CVE-2026-23833 · GHSA-4h3h-63v6-88qx

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

MEDIUM 49

ESPHome is a system to control microcontrollers remotely through Home Automation systems.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00301 Published 2026-01-19 Fixed in 2025.12.7 CWE-190

TI-2025-35691 CVE-2025-57808 · GHSA-mxh2-ccgj-8635

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

HIGH 70

ESPHome is a system to control microcontrollers remotely through Home Automation systems.

CVSS 3.1HIGH 8.1 Adjacent network No auth No interaction EPSS 0.01542 Published 2025-09-02 Fixed in 2025.8.1 CWE-303

TI-2024-19201 CVE-2024-29019 · GHSA-5925-88xh-6h99

ESPHome vulnerable to Authentication bypass via Cross site request forgery

HIGH 70

ESPHome is a system to control microcontrollers remotely through Home Automation systems.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00269 Published 2024-03-21 Fixed in 2024.3.0 CWE-352

TI-2024-18126 CVE-2024-27287 · GHSA-9p43-hj5j-96h5

ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

MEDIUM 41

ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00681 Published 2024-03-06 Fixed in 2024.2.2 CWE-79

TI-2024-17944 CVE-2024-27081 · GHSA-8p25-3q46-8q2p

ESPHome remote code execution via arbitrary file write

HIGH 73

ESPHome is a system to control your ESP8266/ESP32.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01535 Published 2024-02-26 Fixed in 2024.2.1 CWE-22

TI-2021-17945 CVE-2021-41104 · GHSA-48mj-p7x2-5jfm

web_server allows OTA update without checking user defined basic auth username & password

LOW 35

ESPHome is a system to control the ESP8266/ESP32.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01213 Published 2021-09-28 Fixed in 2021.9.2 CWE-306

Vulnerabilities

Filters